Ben Levinsky d0e5e0d376 proxy: Validate retarget read response length ...

_read() converts the peer-provided unsigned data length to a signed
integer and bounds it only against the caller's buffer size. Large
values can bypass that comparison or make memcpy() read beyond the
fixed response buffer.

Reject nonpositive destination sizes, retain the peer length as an
unsigned value, and clamp it to both the response payload capacity and
the caller's buffer before copying.

Signed-off-by: Ben Levinsky <ben.levinsky@amd.com>
Assisted-by: Codex:GPT-5

2026-09-21 09:54:50 +02:00

..

include

rpmsg: rpc: Validate client request lengths

2026-09-21 09:54:50 +02:00

proxy

proxy: Validate retarget read response length

2026-09-21 09:54:50 +02:00

remoteproc

remoteproc: avoid wrapping loader offset comparison

2026-09-21 09:50:11 +02:00

rpmsg

rpmsg: virtio: Change release_rx_buffer_nolock() return type to void

2026-09-09 19:09:56 +02:00

service/rpmsg/rpc

rpmsg: rpc: Validate client request lengths

2026-09-21 09:54:50 +02:00

utils

lib: utils: implement internal safe_strcpy function

2024-10-18 16:13:30 +02:00

virtio

virtqueue: add writable buffer helper

2026-09-21 09:51:59 +02:00

virtio_mmio

virtio_mmio: Statically allocate metal_io_regions

2024-07-05 09:41:06 +02:00

CMakeLists.txt

lib: utils: implement internal safe_strcpy function

2024-10-18 16:13:30 +02:00

version.c

…

version.h.in

…